Are you trying to pass the currently logged in user's credentials to the RADIUS server? If so, I've had good success with using group policy to set up the wireless network. It has options to pass either the user or computer credentials to authenticate. The specific group policy option is at Computer Configuration > Policies > Windows Settings > Security Settings > Wireless Network.

I haven't tried a dot1x configuration over wired this way, but I imagine it operates in a similar fashion. Good luck!

Yep, I remember Cisco referencing routers living in the layer 3 domain as well. When you start looking at things like ACLs in routers, you can classify traffic based on source and destination as you'd expect. However, you can also classify based on source and destination port numbers, which introduces the layer 4 information you're talking about.